I have a worker which acts as a proxy to a third-party upstream service. The upstream service needs

I have a worker which acts as a proxy to a third-party upstream service. The upstream service needs the IP of the original requester. The upstream service only accepts IPv4 sadly what we just found out. Is there a way to disable IPv6 for the worker to always get the IPv4 IP address?

Kkev-ac I have a worker which acts as a proxy to a third-party upstream service. The ups...

Chaika•1/16/24, 5:38 PM

Use a Custom Domain/Route on your own domain, disable IPv6 on the domain/zone

Chaika•1/16/24, 5:40 PM

Worker are behind proxy so that'll just work. You can disable IPv6 via API even on free plan
The limitation is just passing an IPv6 address at all, right? Workers won't force IPv6 if the service doesn't have any AAAA records (because how could it?), unless the upstream service runs on Cloudflare in which case it'd get the Workers Cross-Cloudflare IPv6 IP.
Should really pester them to at least support IPv6 Addresses in 2024 lol

Original message was deleted

dave•1/16/24, 7:47 PM

why would

/path/*

/path/*

be different than

/*

/*

for cold starts?

dave•1/16/24, 7:48 PM

ahh, so

/*

/*

and custom domains are the same then?

Original message was deleted

dave•1/16/24, 7:50 PM

I'm confused, no other difference though, right?

Isaac McFadyen•1/16/24, 8:00 PM

^ Custom domains issue a certificate for the entire (sub-)domain (that's one of their downsides actually, they don't use the existing wildcard cert they issue their own cert)

IIsaac McFadyen ^ Custom domains issue a certificate for the entire (sub-)domain (that's one of ...

dave•1/16/24, 8:01 PM

isn't that a positive?

Unsmart•1/16/24, 8:01 PM

depends if you consider that a downside I guess LUL

Isaac McFadyen•1/16/24, 8:01 PM

So if you ever have a Worker that you don't want to be easily discovered via cert transparency logs, don't use Custom Domains

Isaac McFadyen•1/16/24, 8:01 PM

I mean... I don't really think it's a positive? There's not much benefit to re-issuing a cert.

Isaac McFadyen•1/16/24, 8:01 PM

If you have one for

*.example.com

*.example.com

why issue one for

foo.example.com

foo.example.com

Original message was deleted

dave•1/16/24, 8:01 PM

sanity check, are these messages talking about the same feature? https://discord.com/channels/595317990191398933/779390076219686943/1196903837257170974 and https://discord.com/channels/595317990191398933/779390076219686943/1196837523729682586

CChaika Worker are behind proxy so that'll just work. You can disable IPv6 via API even ...

kev-acOP•1/16/24, 8:02 PM

Disabling IPV6 is still an option while its disabled in the UI? Nice to know

Original message was deleted

dave•1/16/24, 8:02 PM

oh, so the certificate handling is different, but the TLS/cert perf is the same?

CChaika Worker are behind proxy so that'll just work. You can disable IPv6 via API even ...

kev-acOP•1/16/24, 8:02 PM

Yes its the limitation that the upstream service needs an IPV4 because it still does not support IPV6

kev-acOP•1/16/24, 8:03 PM

And it needs to be a valid IPv4 because otherwise there will be connection issues between the client and the service

Kkev-ac Disabling IPV6 is still an option while its disabled in the UI? Nice to know 😅

Chaika•1/16/24, 8:04 PM

via the api yea

Chaika•1/16/24, 8:04 PM

You can always delete it

Chaika•1/16/24, 8:04 PM

it's just an adv. cert under Edge Certs

Chaika•1/16/24, 8:04 PM

if you're fast enough or script it, you can delete it before it issues

IIsaac McFadyen If you have one for `*.example.com` why issue one for `foo.example.com`?

dave•1/16/24, 8:04 PM

so when I do curl -v, I see only the SSL cert for the domain and not the wildcard ;P

Original message was deleted

Chaika•1/16/24, 8:05 PM

yea Worker Custom Domains are just really hacky. You don't need ACM to delete them, or use it. They do count against your ACM Quota though, and show up there

Unsmart•1/16/24, 8:05 PM

Speaking of ACM I think the workers custom domains does use your limit of ACM if you have it or it least did in the past LUL

kian•1/16/24, 8:05 PM

the main feature of custom domains (imo) is not having same-zone fetch issues, but that has been broken since day 1

kian•1/16/24, 8:05 PM

Unsmart•1/16/24, 8:06 PM

I just like how it shows in the dns thats why I use it

Unsmart•1/16/24, 8:06 PM

service bindings are better for fetching anyways so that feature is useless imo

Kkian the main feature of custom domains (imo) is not having same-zone fetch issues, b...

Chaika•1/16/24, 8:07 PM

for me custom domains are just easier and I can just snipe the adv. cert

Chaika•1/16/24, 8:07 PM

no reason to use routes over custom domains if you intend to use the entire subdomain, routes are messier, configuration slightly hidden, and can be misconfigured

Unsmart•1/16/24, 8:09 PM

docs also say this so I just follow it

UUnsmart Speaking of ACM I think the workers custom domains does use your limit of ACM if...

dave•1/16/24, 8:10 PM

we have Total TLS on and our cert count is 0 out of 100.

dave•1/16/24, 8:11 PM

and we have 81 certs

Isaac McFadyen•1/16/24, 8:11 PM

Now that we have descriptions on DNS records I just add a description to the Worker record and use routes lul

CChaika via the api yea

kev-acOP•1/16/24, 8:11 PM

It did indeed work. Thanks for the hint!

kev-acOP•1/16/24, 8:11 PM

Not the best solution but the only possible right now. But having it disabled for the whole zone... suboptimal

Ddave we have Total TLS on and our cert count is 0 out of 100.

Chaika•1/16/24, 8:11 PM

total tls certs don't count

Kkev-ac Not the best solution but the only possible right now. But having it disabled fo...

Chaika•1/16/24, 8:12 PM

convince your upstream to move on from 2006 and support ipv6

dave•1/16/24, 8:13 PM

ahhh

CChaika convince your upstream to move on from 2006 and support ipv6 🙂

kev-acOP•1/16/24, 8:13 PM

They haven't updated their software in the last 4 years but we sadly have to integrate it into our app

kev-acOP•1/16/24, 8:14 PM

I wish they would do it, but I doubt it

IIsaac McFadyen Now that we have descriptions on DNS records I just add a description to the Wor...

dave•1/16/24, 8:19 PM

isn't that ent-only? or am I thinking about tags?

Ddave isn't that ent-only? or am I thinking about tags?

Chaika•1/16/24, 8:19 PM

Neither are Ent-only

Chaika•1/16/24, 8:20 PM

Comments are on free, Tags are Pro or higher

dave•1/16/24, 8:20 PM

ooo nice! thanks

JJ Mocko - Adapture•1/16/24, 8:24 PM

Hi CF developers. I have an existing worker, and I cannot figure out how to have a 'staging' version and a 'production' version of the same worker. I have tried running npx wrangler deploy --env productionnpx wrangler deploy --env production and npx wrangler deploy --env stagingnpx wrangler deploy --env staging but all it does it create a new worker with -production or -staging at the end.

JJ Mocko - Adapture•1/16/24, 8:25 PM

Can someone point me in the right direction?

JJJ Mocko - Adapture Hi CF developers. I have an existing worker, and I cannot figure out how to have...

Chaika•1/16/24, 8:25 PM

but all it does it create a new worker with -production or -staging at the end.

That is how environments work right now with Wrangler

JJ Mocko - Adapture•1/16/24, 8:26 PM

I have other workers that in the dashboard are named the same, and they have a dropdown on the worker page where I can select environment

Chaika•1/16/24, 8:26 PM

There is bits and pieces in the dashboard about the old Service Environments system if you're being confused by that, that shows production and such. James has a write up explaining that all here: https://community.cloudflare.com/t/environments-vs-deployments/451036/2?u=chaika

Chaika•1/16/24, 8:27 PM

The TLDR being the Wrangler way with entirely different Workers is the best way right now and the intended way. You can have specific settings in your wrangler.toml for specific environments as well https://developers.cloudflare.com/workers/wrangler/environments/

Environments · Cloudflare Workers docs

Deploy the same Worker application with different configuration for each environment.

I have a worker which acts as a proxy to a third-party upstream service. The upstream service needs

Similar Threads

Similar Threads

Similar Threads